Pass OCI auth hosts as CLI state

Propagate cross-origin auth host mappings explicitly through command, resolver, and registry request parameters instead of serializing them through the process environment.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: chrmarti

src/spec-common/injectHeadless.ts

@@ -69,6 +69,7 @@ export interface ResolverParameters {
 	omitConfigRemotEnvFromMetadata?: boolean;
 	secretsP?: Promise<Record<string, string>>;
 	omitSyntaxDirective?: boolean;
+	allowedCrossOriginAuthHosts?: string[];
 }
 
 export interface LifecycleHook {

src/spec-configuration/containerCollectionsOCI.ts

@@ -18,6 +18,7 @@ export interface CommonParams {
 	env: NodeJS.ProcessEnv;
 	output: Log;
 	cachedAuthHeader?: Record<string, string>; // <registry, authHeader>
+	allowedCrossOriginAuthHosts?: string[];
 }
 
 // Represents the unique OCI identifier for a Feature or Template.

src/spec-configuration/containerFeaturesConfiguration.ts

@@ -195,6 +195,7 @@ export interface ContainerFeatureInternalParams {
 	platform: NodeJS.Platform;
 	noLockfile?: boolean;
 	frozenLockfile?: boolean;
+	allowedCrossOriginAuthHosts?: string[];
 }
 
 // TODO: Move to node layer.

src/spec-configuration/httpOCIRegistry.ts

@@ -37,8 +37,6 @@ const scopeRegex = /scope="([^"]+)"/;
 
 type RegistryCredentialType = 'basic' | 'refreshToken';
 
-export const allowCrossOriginAuthHostEnv = 'DEVCONTAINERS_INTERNAL_ALLOW_CROSS_ORIGIN_AUTH_HOST';
-
 const builtInCrossOriginAuthHosts = [
 	'registry-1.docker.io=auth.docker.io',
 	'registry.docker.io=auth.docker.io',
@@ -76,19 +74,6 @@ export function parseCrossOriginAuthHosts(entries: readonly string[]): Map<strin
 	return result;
 }
 
-function getCrossOriginAuthHosts(env: NodeJS.ProcessEnv) {
-	const configured = env[allowCrossOriginAuthHostEnv];
-	let configuredEntries: string[] = [];
-	if (configured) {
-		const parsed: unknown = JSON.parse(configured);
-		if (!Array.isArray(parsed) || parsed.some(entry => typeof entry !== 'string')) {
-			throw new Error(`Invalid ${allowCrossOriginAuthHostEnv} value.`);
-		}
-		configuredEntries = parsed;
-	}
-	return parseCrossOriginAuthHosts([...builtInCrossOriginAuthHosts, ...configuredEntries]);
-}
-
 function isConfiguredCrossOriginAuthHost(registryUrl: URL, realmUrl: URL, crossOriginAuthHosts: Map<string, Set<string>>) {
 	return crossOriginAuthHosts.get(registryUrl.host.toLowerCase())?.has(realmUrl.host.toLowerCase()) || false;
 }
@@ -235,7 +220,7 @@ export async function requestEnsureAuthenticated(params: CommonParams, httpOptio
 			}
 			let crossOriginAuthHosts: Map<string, Set<string>>;
 			try {
-				crossOriginAuthHosts = getCrossOriginAuthHosts(params.env);
+				crossOriginAuthHosts = parseCrossOriginAuthHosts([...builtInCrossOriginAuthHosts, ...(params.allowedCrossOriginAuthHosts || [])]);
 			} catch (err) {
 				output.write(`[httpOci] ERR: ${err}`, LogLevel.Error);
 				return;

src/spec-node/devContainers.ts

@@ -74,6 +74,7 @@ export interface ProvisionOptions {
 	omitSyntaxDirective?: boolean;
 	includeConfig?: boolean;
 	includeMergedConfig?: boolean;
+	allowedCrossOriginAuthHosts?: string[];
 }
 
 export async function launch(options: ProvisionOptions, providedIdLabels: string[] | undefined, disposables: (() => Promise<unknown> | undefined)[]) {
@@ -162,6 +163,7 @@ export async function createDockerParams(options: ProvisionOptions, disposables:
 			targetPath: options.dotfiles.targetPath || '~/dotfiles',
 		},
 		omitSyntaxDirective: options.omitSyntaxDirective,
+		allowedCrossOriginAuthHosts: options.allowedCrossOriginAuthHosts,
 	};
 
 	const dockerPath = options.dockerPath || 'docker';

src/spec-node/devContainersSpecCLI.ts

@@ -45,7 +45,7 @@ import { featuresGenerateDocsHandler, featuresGenerateDocsOptions } from './feat
 import { templatesGenerateDocsHandler, templatesGenerateDocsOptions } from './templatesCLI/generateDocs';
 import { mapNodeOSToGOOS, mapNodeArchitectureToGOARCH } from '../spec-configuration/containerCollectionsOCI';
 import { templateMetadataHandler, templateMetadataOptions } from './templatesCLI/metadata';
-import { allowCrossOriginAuthHostEnv, parseCrossOriginAuthHosts } from '../spec-configuration/httpOCIRegistry';
+import { parseCrossOriginAuthHosts } from '../spec-configuration/httpOCIRegistry';
 
 const defaultDefaultUserEnvProbe: UserEnvProbe = 'loginInteractiveShell';
 
@@ -70,14 +70,14 @@ const mountRegex = /^type=(bind|volume),source=([^,]+),target=([^,]+)(?:,externa
 		.option('allow-cross-origin-auth-host', {
 			type: 'string',
 			array: true,
+			nargs: 1,
 			global: true,
 			description: 'Allow an OCI registry to use a cross-origin HTTPS authentication host. Format: <registry-host>=<auth-host>. May be repeated.',
 		})
-		.middleware(args => {
-			const entries = args['allow-cross-origin-auth-host'] || [];
-			parseCrossOriginAuthHosts(entries);
-			process.env[allowCrossOriginAuthHostEnv] = JSON.stringify(entries);
-		}, true)
+		.check(args => {
+			parseCrossOriginAuthHosts(getAllowedCrossOriginAuthHosts(args as OciAuthArgs));
+			return true;
+		})
 		.strict();
 	y.wrap(Math.min(120, y.terminalWidth()));
 	y.command('up', 'Create and run dev container', provisionOptions, provisionHandler);
@@ -108,6 +108,11 @@ const mountRegex = /^type=(bind|volume),source=([^,]+),target=([^,]+)(?:,externa
 })().catch(console.error);
 
 export type UnpackArgv<T> = T extends Argv<infer U> ? U : T;
+export type OciAuthArgs = { 'allow-cross-origin-auth-host'?: string[] };
+
+export function getAllowedCrossOriginAuthHosts(args: OciAuthArgs) {
+	return args['allow-cross-origin-auth-host'] || [];
+}
 
 function provisionOptions(y: Argv) {
 	return y.options({
@@ -188,7 +193,7 @@ function provisionOptions(y: Argv) {
 		});
 }
 
-type ProvisionArgs = UnpackArgv<ReturnType<typeof provisionOptions>>;
+type ProvisionArgs = UnpackArgv<ReturnType<typeof provisionOptions>> & OciAuthArgs;
 
 function provisionHandler(args: ProvisionArgs) {
 	runAsyncHandler(provision.bind(null, args));
@@ -241,6 +246,7 @@ async function provision({
 	'omit-syntax-directive': omitSyntaxDirective,
 	'include-configuration': includeConfig,
 	'include-merged-configuration': includeMergedConfig,
+	'allow-cross-origin-auth-host': allowedCrossOriginAuthHosts,
 }: ProvisionArgs) {
 
 	warnDeprecatedLockfileFlags(experimentalLockfile, experimentalFrozenLockfile);
@@ -315,6 +321,7 @@ async function provision({
 		omitSyntaxDirective,
 		includeConfig,
 		includeMergedConfig,
+		allowedCrossOriginAuthHosts,
 	};
 
 	const result = await doProvision(options, providedIdLabels);
@@ -395,7 +402,7 @@ function setUpOptions(y: Argv) {
 		});
 }
 
-type SetUpArgs = UnpackArgv<ReturnType<typeof setUpOptions>>;
+type SetUpArgs = UnpackArgv<ReturnType<typeof setUpOptions>> & OciAuthArgs;
 
 function setUpHandler(args: SetUpArgs) {
 	runAsyncHandler(setUp.bind(null, args));
@@ -432,6 +439,7 @@ async function doSetUp({
 	'container-session-data-folder': containerSessionDataFolder,
 	'include-configuration': includeConfig,
 	'include-merged-configuration': includeMergedConfig,
+	'allow-cross-origin-auth-host': allowedCrossOriginAuthHosts,
 }: SetUpArgs) {
 
 	const disposables: (() => Promise<unknown> | undefined)[] = [];
@@ -482,6 +490,7 @@ async function doSetUp({
 				installCommand: dotfilesInstallCommand,
 				targetPath: dotfilesTargetPath,
 			},
+			allowedCrossOriginAuthHosts,
 		}, disposables);
 
 		const { common } = params;
@@ -573,7 +582,7 @@ function buildOptions(y: Argv) {
 		});
 }
 
-type BuildArgs = UnpackArgv<ReturnType<typeof buildOptions>>;
+type BuildArgs = UnpackArgv<ReturnType<typeof buildOptions>> & OciAuthArgs;
 
 function buildHandler(args: BuildArgs) {
 	runAsyncHandler(build.bind(null, args));
@@ -614,6 +623,7 @@ async function doBuild({
 	'no-lockfile': noLockfile,
 	'frozen-lockfile': frozenLockfile,
 	'omit-syntax-directive': omitSyntaxDirective,
+	'allow-cross-origin-auth-host': allowedCrossOriginAuthHosts,
 }: BuildArgs) {
 	warnDeprecatedLockfileFlags(experimentalLockfile, experimentalFrozenLockfile);
 	const effectiveFrozenLockfile = frozenLockfile || experimentalFrozenLockfile;
@@ -667,6 +677,7 @@ async function doBuild({
 			noLockfile,
 			frozenLockfile: effectiveFrozenLockfile,
 			omitSyntaxDirective,
+			allowedCrossOriginAuthHosts,
 		}, disposables);
 
 		const { common, dockerComposeCLI } = params;
@@ -842,7 +853,7 @@ function runUserCommandsOptions(y: Argv) {
 		});
 }
 
-type RunUserCommandsArgs = UnpackArgv<ReturnType<typeof runUserCommandsOptions>>;
+type RunUserCommandsArgs = UnpackArgv<ReturnType<typeof runUserCommandsOptions>> & OciAuthArgs;
 
 function runUserCommandsHandler(args: RunUserCommandsArgs) {
 	runAsyncHandler(runUserCommands.bind(null, args));
@@ -1035,7 +1046,7 @@ function readConfigurationOptions(y: Argv) {
 		});
 }
 
-type ReadConfigurationArgs = UnpackArgv<ReturnType<typeof readConfigurationOptions>>;
+type ReadConfigurationArgs = UnpackArgv<ReturnType<typeof readConfigurationOptions>> & OciAuthArgs;
 
 function readConfigurationHandler(args: ReadConfigurationArgs) {
 	runAsyncHandler(readConfiguration.bind(null, args));
@@ -1060,6 +1071,7 @@ async function readConfiguration({
 	'include-merged-configuration': includeMergedConfig,
 	'additional-features': additionalFeaturesJson,
 	'skip-feature-auto-mapping': skipFeatureAutoMapping,
+	'allow-cross-origin-auth-host': allowedCrossOriginAuthHosts,
 }: ReadConfigurationArgs) {
 	const disposables: (() => Promise<unknown> | undefined)[] = [];
 	const dispose = async () => {
@@ -1116,7 +1128,8 @@ async function readConfiguration({
 			env: cliHost.env,
 			output,
 			buildPlatformInfo,
-			targetPlatformInfo: buildPlatformInfo
+			targetPlatformInfo: buildPlatformInfo,
+			allowedCrossOriginAuthHosts,
 		};
 		const { container, idLabels } = await findContainerAndIdLabels(params, containerId, providedIdLabels, workspaceFolder, configPath?.fsPath);
 		if (container) {
@@ -1174,7 +1187,7 @@ function outdatedOptions(y: Argv) {
 	});
 }
 
-type OutdatedArgs = UnpackArgv<ReturnType<typeof outdatedOptions>>;
+type OutdatedArgs = UnpackArgv<ReturnType<typeof outdatedOptions>> & OciAuthArgs;
 
 function outdatedHandler(args: OutdatedArgs) {
 	runAsyncHandler(outdated.bind(null, args));
@@ -1189,6 +1202,7 @@ async function outdated({
 	'log-format': logFormat,
 	'terminal-rows': terminalRows,
 	'terminal-columns': terminalColumns,
+	'allow-cross-origin-auth-host': allowedCrossOriginAuthHosts,
 }: OutdatedArgs) {
 	const disposables: (() => Promise<unknown> | undefined)[] = [];
 	const dispose = async () => {
@@ -1225,6 +1239,7 @@ async function outdated({
 			env: cliHost.env,
 			skipFeatureAutoMapping: false,
 			platform: cliHost.platform,
+			allowedCrossOriginAuthHosts,
 		};
 
 		const outdated = await loadVersionInfo(params, configs.config.config);

src/spec-node/featureUtils.ts

@@ -9,5 +9,5 @@ export async function readFeaturesConfig(params: DockerCLIParameters, pkg: Packa
 	const { cwd, env, platform } = cliHost;
 	const featuresTmpFolder = await createFeaturesTempFolder({ cliHost, package: pkg });
 	const cacheFolder = await getCacheFolder(cliHost);
-	return generateFeaturesConfig({ extensionPath, cacheFolder, cwd, output, env, skipFeatureAutoMapping, platform, noLockfile: true }, featuresTmpFolder, config, additionalFeatures);
+	return generateFeaturesConfig({ extensionPath, cacheFolder, cwd, output, env, skipFeatureAutoMapping, platform, noLockfile: true, allowedCrossOriginAuthHosts: params.allowedCrossOriginAuthHosts }, featuresTmpFolder, config, additionalFeatures);
 }

src/spec-node/featuresCLI/info.ts

@@ -3,7 +3,7 @@ import { OCIManifest, OCIRef, fetchOCIManifestIfExists, getPublishedTags, getRef
 import { Log, LogLevel, mapLogLevel } from '../../spec-utils/log';
 import { getPackageConfig } from '../../spec-utils/product';
 import { createLog } from '../devContainers';
-import { UnpackArgv } from '../devContainersSpecCLI';
+import { OciAuthArgs, UnpackArgv } from '../devContainersSpecCLI';
 import { buildDependencyGraph, generateMermaidDiagram } from '../../spec-configuration/containerFeaturesOrder';
 import { DevContainerFeature } from '../../spec-configuration/configuration';
 import { processFeatureIdentifier } from '../../spec-configuration/containerFeaturesConfiguration';
@@ -19,7 +19,7 @@ export function featuresInfoOptions(y: Argv) {
 		.positional('feature', { type: 'string', demandOption: true, description: 'Feature Identifier' });
 }
 
-export type FeaturesInfoArgs = UnpackArgv<ReturnType<typeof featuresInfoOptions>>;
+export type FeaturesInfoArgs = UnpackArgv<ReturnType<typeof featuresInfoOptions>> & OciAuthArgs;
 
 export function featuresInfoHandler(args: FeaturesInfoArgs) {
 	runAsyncHandler(featuresInfo.bind(null, args));
@@ -36,6 +36,7 @@ async function featuresInfo({
 	'feature': featureId,
 	'log-level': inputLogLevel,
 	'output-format': outputFormat,
+	'allow-cross-origin-auth-host': allowedCrossOriginAuthHosts,
 }: FeaturesInfoArgs) {
 	const disposables: (() => Promise<unknown> | undefined)[] = [];
 	const dispose = async () => {
@@ -51,7 +52,7 @@ async function featuresInfo({
 		terminalDimensions: undefined,
 	}, pkg, new Date(), disposables, true);
 
-	const params = { output, env: process.env, outputFormat };
+	const params = { output, env: process.env, outputFormat, allowedCrossOriginAuthHosts };
 
 	const jsonOutput: InfoJsonOutput = {};
 

src/spec-node/featuresCLI/publish.ts

@@ -5,7 +5,7 @@ import { LogLevel, mapLogLevel } from '../../spec-utils/log';
 import { rmLocal } from '../../spec-utils/pfs';
 import { getPackageConfig } from '../../spec-utils/product';
 import { createLog } from '../devContainers';
-import { UnpackArgv } from '../devContainersSpecCLI';
+import { OciAuthArgs, UnpackArgv } from '../devContainersSpecCLI';
 import { doFeaturesPackageCommand } from './packageCommandImpl';
 import { getCLIHost } from '../../spec-common/cliHost';
 import { loadNativeModule } from '../../spec-common/commonUtils';
@@ -21,7 +21,7 @@ export function featuresPublishOptions(y: Argv) {
     return publishOptions(y, 'feature');
 }
 
-export type FeaturesPublishArgs = UnpackArgv<ReturnType<typeof featuresPublishOptions>>;
+export type FeaturesPublishArgs = UnpackArgv<ReturnType<typeof featuresPublishOptions>> & OciAuthArgs;
 
 export function featuresPublishHandler(args: FeaturesPublishArgs) {
 	runAsyncHandler(featuresPublish.bind(null, args));
@@ -31,7 +31,8 @@ async function featuresPublish({
     'target': targetFolder,
     'log-level': inputLogLevel,
     'registry': registry,
-    'namespace': namespace
+    'namespace': namespace,
+	'allow-cross-origin-auth-host': allowedCrossOriginAuthHosts,
 }: FeaturesPublishArgs) {
     const disposables: (() => Promise<unknown> | undefined)[] = [];
     const dispose = async () => {
@@ -49,7 +50,7 @@ async function featuresPublish({
         terminalDimensions: undefined,
     }, pkg, new Date(), disposables);
 
-    const params = { output, env: process.env };
+    const params = { output, env: process.env, allowedCrossOriginAuthHosts };
 
     // Package features
     const outputDir = path.join(os.tmpdir(), `/features-output-${Date.now()}`);

src/spec-node/featuresCLI/resolveDependencies.ts

@@ -3,7 +3,7 @@ import { Argv } from 'yargs';
 import { LogLevel, mapLogLevel } from '../../spec-utils/log';
 import { getPackageConfig } from '../../spec-utils/product';
 import { createLog } from '../devContainers';
-import { UnpackArgv } from '../devContainersSpecCLI';
+import { OciAuthArgs, UnpackArgv } from '../devContainersSpecCLI';
 import { isLocalFile } from '../../spec-utils/pfs';
 import { DevContainerFeature } from '../../spec-configuration/configuration';
 import { buildDependencyGraph, computeDependsOnInstallationOrder, generateMermaidDiagram } from '../../spec-configuration/containerFeaturesOrder';
@@ -34,7 +34,7 @@ export function featuresResolveDependenciesOptions(y: Argv) {
 		});
 }
 
-export type featuresResolveDependenciesArgs = UnpackArgv<ReturnType<typeof featuresResolveDependenciesOptions>>;
+export type featuresResolveDependenciesArgs = UnpackArgv<ReturnType<typeof featuresResolveDependenciesOptions>> & OciAuthArgs;
 
 export function featuresResolveDependenciesHandler(args: featuresResolveDependenciesArgs) {
 	runAsyncHandler(featuresResolveDependencies.bind(null, args));
@@ -43,6 +43,7 @@ export function featuresResolveDependenciesHandler(args: featuresResolveDependen
 async function featuresResolveDependencies({
 	'workspace-folder': workspaceFolderArg,
 	'log-level': inputLogLevel,
+	'allow-cross-origin-auth-host': allowedCrossOriginAuthHosts,
 }: featuresResolveDependenciesArgs) {
 	const disposables: (() => Promise<unknown> | undefined)[] = [];
 	const dispose = async () => {
@@ -73,6 +74,7 @@ async function featuresResolveDependencies({
 	const params = {
 		output,
 		env: process.env,
+		allowedCrossOriginAuthHosts,
 	};
 
 	const cwd = workspaceFolder || process.cwd();